Open Directory conection for Client inconsistant

Hi,
Been working setting up several labs during the summer and have come across a new problem. When joining the computers to Open Directory the comptuers connect to the Replica and are added to the Open Directory list. However, at the login screen the signal for the status of the directory connection keeps changing from Green to Yellow and never activates my preferences for the computer.
Anybody run into this before or have seen a solution to this? Have tried to connect to other replicas as well as the master and have run into the same issue.
Thanks!

Ok, I got it.
But what if I want the OD user to have some configuration data on the local client?
Let me explain that a bit better. The configuration I would like for my network and users is as follows: the server works only as an authentication server, I do not want roaming profiles or homes directory on the server; I just want the server to authenticate users when they log in to several client machines amongst the lan.
For documents sharing, in fact, I much rather prefer using Dropbox, which allows my users to share on a WAN-instead-of-LAN basis.
But a home local directory is needed for OD users to keep libraries, preferences files and so on.
Back to the old Windows server (PDC) time, I used the server as a name server authentication only, still the client created a local profile for the user of the server.
Does OD works this way too or am I missing something?
Thank you.

Similar Messages

Is Open Directory required for Webmail??

Anyone know if I need to enable Open Directory (Tiger Server) in order to use webmail successfully? Currently I am trying to get it going with all users on the local directory but it's not working. Thanks for any help. Rob

Hi
Is Open Directory required for WebMail?
No.
The Web Service needs to be enabled. For that to work effectively DNS needs to be configured and running. Its not absolutely necessary but its better if it is. Obviously the Mail Service needs to be running as well as users having Mail enabled for them in WorkGroup Manager. Obviously you need to enable IMAP for desired users. Either POP and IMAP or IMAP only.
In the Web Service enable the WebMail option. Server Admin > Web > Settings > Sites. You need to enable the WebDAV Module as well. Its in the Modules section. That should be it.
If you want external access open port 16080 and allow public/external requests to the private/internal IP address of your mail server. Create an appropriate firewall rule if your router requires it.
Tony

Open Directory Usefulness for Home Server

I'm using Mountain Lion Server primarily as a web server, but as a retired tech writer/programmer I like to fool around with things in case I ever need to return to work. I set up the Open Directory master as part of the installation process, but I'm not sure how useful it is for me. When my site was hosted on Mobileme I got about 30 visits in a day max, and about 1 comment every year or two. So my questions are:
How useful is the Open Directory for me, and is there any point in keeping it turned on?
Is it useful for people outside of my LAN?
Any additional comments, or information are appreciated.

<bump>

Server 4: open directory entry for server reports wrong IP address

I'm running Server 4 on a Mac Mini (late 2012) running OS X 10.10.
The server is configured as a stand-alone machine providing services to users connecting over its fixed IP public address. The server uses Open Directory to keep record of authorised users of the services provided (mail, calendar, wiki, contacts, some file sharing), and the machine is configured as an OD master.
I've noticed that the entry relating to the server on the Server 4 panel for Open Directory (the only entry showing by the way) lists three IP addresses below the name of the machine. My concern is that these IP addresses are not related to the IP address being used by the machine, and there does not appear to be any simple way to change them. The IPs reported are 10.37.129.2, 10.0.1.2, 10.211.55.2. The server's fixed IP is in the range 45.146.x.x and the local network running below our router that the server connects to has IPs in the range 192.168.1.x. So It is not clear where these IPs might be coming from.
What do these numbers relate to? If they are important, should they point to the IP address occupied by the server? If so, how do I make this change in settings?
Thanks a lot in advance for any help that you can provide.

<bump>

One Open Directory server for multiple businesses?

Hi all,
Is it possible to have one Mac OS X server seen by client computers through different domain names?
See, I have one server now, with name:
server01.it.lan
As we are managing three different companies, I'd like the users working for one particular company to see the server with that company's name:
server01.bizA.lan
or
server01.bizB.lan
...and so on.
And I'd want whatever service used by that user to have a path or address that refers to that name, even though it will point to the same server in the end...
After some reading, I have different avenues available which would each require quite some reading. So I'm turning to you to narrow the field of researches.
1. First of all, is this possible? I mean, not-too-complicated possible?
2. Where would you recommend I spend time learning?
- DNS aliases? AFP seems to go back to the primary name when I use an alias in Directory Access... (shows server01.it.lan/share instead of server01.bizA.lan/share)
- Network configuration duplicates, to have more than one IP address pointing to the same machine?
- Other ideas? I don't need/want a full walkthrough. Actually, I'd prefer to just have simple hints to direct my researches...
Thanks,
Fred

Hi Leandro,
For your requirement this document describes the TREX installation -
[TREX with Multiple Instances|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/78df2a46-0a01-0010-ef81-a6be60cc5cfd]
Hope this helps,
Reward points if helpful
Regards,
Shailesh Nagar

Cannot add shared Contacts in Open Directory from a client

Hello all
I need to transfer vCards from a local Address book to the Server and I need them to be shown in each client's Address book.
*Problem 1:* I cannot add or edit shared contact using the Directory app. from a client to a 10.5.3 Server. Only the Directory Admin credentials are valid. The client 10.5.5 is bound OK. The app is configured to use password, not Kerberos, and the Server is "responding normally" in the Directory Utility application.
I can even login as a mobile user with Network Home. Same there.
*Problem 2:* Ive put in Address Book the correct LDAP settings, but I cannot see a catalog of vCards. If I search using the search field, I get results, but I need them to be shown all as catalog.
Thanks in advance
Kostas

This turned out to be a reverse DNS configuration problem. Apple support suggested using a local ip address instead of my public host name. That worked so I looked into the reverse dns configuration. I fooled myself by thinking that if I could reach my host with my.host.com with other services like http, that my DNS was set up correctly. My reverse DNS originally resolved to my.host.com when it should have been something more like 123-456-789-103.cos.pcisys.net. Now I can reach my host from anywhere with the Directory application.

Use Open Directory for intranet web acces

Is it possible to tap in to Open Directory user information from other services than those build into the server? And that way use the Open Directory authentication for our own home-made service?
We plan to setup an intranet on our OS X 10.6 server. We're still not sure whether to use one of the popular Open Source cms/portal platforms such as Drupal or maybe even WordPress.
1. I would like to use the users accounts in our Open Directory to authenticate to the intranet. Is that possible in any way?
2. Or does anyone know of a way to modify e.g. the build in blog function and integrate that with another system such as Drupal or WordPress?
I'm guessing there are blocks of code in the blog that handle user authentication. And if I keep them where they are on the server and include them in other Drupal files, it may be possible? Is the build in blog build on an open source system like some of the other services on Mac OS X server? A system I can read about anywhere?
+Note: The build in blog or wiki service does not match our needs for an intranet. We need to customize it a lot to make i suit our needs.+
3. Plan B could be to export our 100 users and passwords from Open Directory and import them in the intranet system. But as far as I know it's impossible to export the passwords. Right?
+New users would then have to be added to both Open Directory and the separate intranet system in the future. That would be okay for working but not perfect Plan B.+

ryanowich wrote:
Is it possible to tap in to Open Directory user information from other services than those build into the server?
Yes.
And that way use the Open Directory authentication for our own home-made service?
Sure. I have HP OpenVMS systems that are authenticating to Mac OS X Server boxes. LDAP has a callable interface for applications written in most any active programming language, and many packages already have LDAP support.
We plan to setup an intranet on our OS X 10.6 server. We're still not sure whether to use one of the popular Open Source cms/portal platforms such as Drupal or maybe even WordPress.
You need to narrow your requirements and your ideas somewhat, and work toward a list of features.
I have some discussions posted of what I went through when I ended up picking Drupal.
1. I would like to use the users accounts in our Open Directory to authenticate to the intranet. Is that possible in any way?
Network servers (Apache, DHCP, etc) can authenticate to LDAP, but (once granted access via DHCP and RADIUS, or analogous) clients don't usually further authenticate.
Within Drupal, the [Drupal|http://drupal.org] module [ldapauth|http://drupal.org/node/118092] would be worth a test. That's an available connection into LDAP. (Haven't prototyped that module, though.)
2. Or does anyone know of a way to modify e.g. the build in blog function and integrate that with another system such as Drupal or WordPress?
You're apparently not familiar with Drupal. You might want to learn more about it, and particularly its extensibility. Drupal can be connected to some refrigerators, if you were inclined to do so.
I'm guessing there are blocks of code in the blog that handle user authentication. And if I keep them where they are on the server and include them in other Drupal files, it may be possible? Is the build in blog build on an open source system like some of the other services on Mac OS X server? A system I can read about anywhere?
Including random blocks of code isn't a strategy for success. Understanding the basics of how the pieces fit together tends to be a better strategy. For Drupal, there's always the [Drupal documentation|http://drupal.org/documentation], or the available books on the CMS. Or you can call in somebody that's done this stuff.
+Note: The build in blog or wiki service does not match our needs for an intranet. We need to customize it a lot to make i suit our needs.+
The built-in services are limited, yes. I've been running Drupal on Mac OS X Server for years now.
3. Plan B could be to export our 100 users and passwords from Open Directory and import them in the intranet system. But as far as I know it's impossible to export the passwords. Right?
I would sincerely hope you don't get the passwords out of your authentication system. That would be bad. Cleartext passwords are bad news. You don't want that ability.
+New users would then have to be added to both Open Directory and the separate intranet system in the future. That would be okay for working but not perfect Plan B.+
That would be a hassle.
And I've tested with Wordpress on Mac OS X Server, but haven't deployed it in production. I'll leave discussions of its features and capabilities to others. That written, you might try the [Wordpress web site|http://Wordpress.org], as I'd expect there would be discussions of LDAP there.
I'd suggest determining your requirements, otherwise you're going to flail around given the numbers of options an alternatives here. If you have your requirements, then you have a framework to pick your tools. [Here is what I looked at when I picked Drupal|http://labs.hoffmanlabs.com/node/100].

Moving Mail Users from a Local Directory to Open Directory

Hi,
We have been running a standalone mail server for a few years. We have recently upgraded to 10.5 for all of our servers. We have also been running an Open Directory server for the last year or so. Now I am trying to move my email users from the Local Directory on the Mail server to the LDAP server. Obviously we do not want to change account names, so I find I need to delete the local user and then enable the user through the LDAP. This works fine, but I need to bring the original IMAP files/folders forward.
My question is what is the best practice? I thought backing up the Mail folder in each user's Library and reimporting it would work, but it won't take the IMAP mbox (I can see all the .emlx files in the backup of the user's Mail folder).
So again, I had a user called user1 in my mail server Local directory say server1. I also have an Open Directory server2 with the same username on it. I have bound server1 to server2. I can see the server2 (OD) accounts on the server1 (mail). I then need to delete user1 from Local server1 directory in order to enable mail to user1 from the OD. This does work, but again, I need bring the mail files/folders to the new OD account on server1.
thanks,
mike

Tony,
Let me check of the migration manual, thank you!
I really thought this was going to easier than this. The current accounts are IMAP, and therefore when I "hook up" the new OD account, which doesn't really need anything done on the client side because it is the same username and password and server as the current Local account. When it syncs, the old emails on the IMAP account in the user's Mail program clear since the new OD account is empty on the server.
I just really thought duplicating the Mail folder in the client's home Library would allow me to import the emails back in. I have tried highlighting the mailboxes (Inbox, and personal folders), archiving them, and then reimporting seemed to work, but I need to beat it up before I start working on live accounts. One account I did try lets me read the emails from the user, but when I try dragging them to the IMAP folders from the import folder, I get a NULL character problem on IMAP append error. NOT to chase that, but it was something else that tripped me up.
You do bring up a good point, I think the accounts were originally setup as POP and IMAP. I'll chase some ideas about that.
Let me play around, you've been great considering my awful explanation of this different situation.
thanks again,
mike

Mac OS 10.8.3 Server Open Directory

Hi.
Sorry for my english.
The problem is that to set it "OS X Server Account" on the client, in the settings of email I can not get an address that points to the account properties Open Directory. For example:
User - Mark Douglas
Login - m.duglas
email - [email protected]
But that I did not, I can not get the client automatically adjusting the desired result to me, only "[email protected]"

Hi.
Sorry for my english.
The problem is that to set it "OS X Server Account" on the client, in the settings of email I can not get an address that points to the account properties Open Directory. For example:
User - Mark Douglas
Login - m.duglas
email - [email protected]
But that I did not, I can not get the client automatically adjusting the desired result to me, only "[email protected]"

Some Open Directory accounts will not log in

At the school where I work, the Open Directory master is running 10.6.8 Server and the clients are running 10.7.4. I am preparing images to update all the clients to 10.8.3, and I've run into a curious issue.
In our setup, we have a single Open Directory account for each classroom. They are set up for simultaneous login, and their home folders are created in /Users rather than on a network share. We have 20 or so unique room accounts, and the text boxes I'm working with now can log into almost all of them. However, there are a few that simply refuse.
When I attempt to log into one of those accounts, the login window immediately shakes as if I've put in the wrong password. However, I've confirmed that the password is correct. I've also checked through the settings of those accounts to make sure they're in line with all the rest of them. I know that they work because our lab Macs, which are currently running 10.7.4 are able to log into them just fine.
I've tried unbinding and rebinding the clients to the OD server, as well as manually creating a home folder in /Users, neither of which works. I have found a little bit of voodoo that seems to work sometimes. I have to bind to the OD server, then check "Allow Network Users at Login Window", then select "Only These Users", then add all of the available network users to the list. Then, I delete them all, restart the computer, and sometimes that works. Not always though.
Has anybody run into this before?

As far as I can tell, the server isn't logging much with regard to the passwords being refused. I have tried attempting to log in to the accounts that don't work and then checking the Open Directory logs within Server Admin, but I don't see anything either relating to that user or with a timestamp that's close to the time to log in.
On the client side, the log entry I see that relates to that user trying to log in is:
5/30/13 10:03:28.001 AM SecurityAgent[147]: User info context values set for r364epson
Which log in the Server Admin app would errors like this be likely to be logged in?

How to configure Open Directory base DN

Hi,
I have been using OpenLDAP on a Synology NAS drive, but this has some serious shortcomings with Mac clients (eg. roaming profiles simply doesn't work).
So I have bought a MacMini which among other things will replace my existing LDAP server with Open Directory.
As a dry run, I enabled the Open Directory and went through the simple set up and I had a basic system up in no time. However I have come up against an annoying issue with the base DN used by Open Directory and I hope someone will be able to help me.
My existing LDAP has a base DN that looks like this: dc=myorg, dc=local
So when users log in, they can use a username which conforms to the following format: [email protected]
The problem is that Open Directory likes to set the base DN to: dc=macservername, dc=myorg, dc=local
meaning that a fully qualified user account name now becomes: [email protected]
This seems bonkers to me. For example, what would happen if I introduce a second Mac server into the mix and failover to it - the servername element of the DN becomes redundant or if it changes, I need to communicate with all users.
I must be missing something obvious - but there doesn't seem to be much in the way of configuration that I can see through the Server application.
So, my question is, how can I configure my base dn without the servername so that my existing username context remains the same?
Many thanks - I look forward to any responses.

I agree with Dal78 Apple using a base DN of servername.example.com rather than just example.com is illogical. In fact originally they did seem to use just example.com as the format but in recent years now use server.example.com as the format. When I first encountered this change it was still possible to overridge the use of servername.example.com and force it to use just example.com as the format. In more recent times I have decided to leave things the way Apple do it.
I don't know if there is an official answer as to why, but a possible guess is that you can now have multiple Open Directory servers for a single domain. This is the 'Locales' option in Server.app. It maybe that including the servername makes it possible/easier to implement this.
I also agree Strontium90 do not use a .local root domain for Open Directory. In theory there are hacks to (sort of) get this to work, but Apple engineers will typically run screaming for the woods when they encounter this.
PS. Briefly Apple also did the same illogical thing with DNS zones, whereby the zone name for a domain was servername.example.com instead of example.com this at least they have stopped doing.

Configure Open Directory using CLI

We have a Leopard Server in Advanced Mode.
If you have a fresh install of Leopard Server with nothing configured, is there a way to configure Open Directory to be an Open Directory Master completely using CLI utilities?
Wasn't able to find anything in Apple's PDFs

I agree with Dal78 Apple using a base DN of servername.example.com rather than just example.com is illogical. In fact originally they did seem to use just example.com as the format but in recent years now use server.example.com as the format. When I first encountered this change it was still possible to overridge the use of servername.example.com and force it to use just example.com as the format. In more recent times I have decided to leave things the way Apple do it.
I don't know if there is an official answer as to why, but a possible guess is that you can now have multiple Open Directory servers for a single domain. This is the 'Locales' option in Server.app. It maybe that including the servername makes it possible/easier to implement this.
I also agree Strontium90 do not use a .local root domain for Open Directory. In theory there are hacks to (sort of) get this to work, but Apple engineers will typically run screaming for the woods when they encounter this.
PS. Briefly Apple also did the same illogical thing with DNS zones, whereby the zone name for a domain was servername.example.com instead of example.com this at least they have stopped doing.

Open directory server crashing every 30 days / clients unable to connect to calendar, contacts server

Hello everyone,
I am running an up to date Mavericks Server which serves exclusively as a calendar and contacts server for about two dozens devices. The server is reachable via DynDNS, however, the public IP hardly ever changes (only once or twice a year maybe). Tried setting the OS X DNS Server to serve "all clients" and "some clients".
For about 6 months (i.e. also under Mountain Lion), I am having a very strange problem. Roughly every 20-30 days, clients will not be able to connect to the server, instead getting a "wrong password" dialog. Restarting the open directory server will help for the next 30 days.
I have tried repairing the database as detailed here, however, the issue persists.
Any help would be highly appreciated!
I would have tried setting up a clean server installation, migrating calendars/contacts manually and re-adding all users by hand, however, I am not aware of an easy way to do so. The terminal command for calendar backup is broken under mavericks (might work with this workaround) and re-adding users manually would apparently involve correcting user UUIDs afterwards in order to match the migrated calendar data. Do you know of a better approach?
Thanks a lot!
DPSG-Scout

Hi Linc,
This looks the most relevant to me:
opendirectory.log
2014-03-11 11:13:09.460675 CET - 333.2628758.2628759 - Client: Python, UID: 93, EUID: 93, GID: 93, EGID: 93
2014-03-11 11:13:09.460675 CET - 333.2628758.2628759, Node: /Local/Default, Module: PlistFile - predicates with 'AND' are not supported
2014-03-11 12:09:00.296514 CET - State information (some requests have been active for extended period):
          Sessions: {
              28 -- opendirectoryd:
                          Session ID: 7BFBA6FE-A968-4399-A129-E3A5945E2A81
                          Refs: singleton
                          Type: Default
                          Target: localhost
          Nodes: {
              43 -- authd:
                          Node ID: 6D0E236D-6DBD-4E8C-BC01-B3F50C2C2D8E
                          Nodename: /LDAPv3/127.0.0.1
                          Session ID: <Default>
                          Refs: 1
                          Internal Use: X
an many more similar ones…
Thanks for your effort!

Using iChat Server with Windows clients in an integrated Active Directory/Open Directory environment

A co-worker (Super Brent) and I were working on using iChat as an internal IM server after having used Openfire for a couple days. The reason for switching was basically that we had a Mac Mini Server that was available so we decided to take this on.
First problem: Knowing whether or not Kerberos was needed for AD/OD integration. We spent a ton of time on this, not knowing a huge amount about AD and with our server administrator on courses, we just kept poking at it and removed Kerberos.
For the AD/OD integration, we first bound the Mac Mini to our Active Directory server. We shut off LDAPv3 support as we only wanted to use the AD functionality. Additionally, we ensured that the search policy in Directory Utility only used Active Directory. Then we created an Open Directory master in the Open Directory service. We enabled a self-signed certificate and trusted it locally. After creating the iChat service, ensure that you use the self-signed SSL Certificate and set authentication to Standard. (no kerberos).
Second problem: Once this was complete, we started to test clients out. We were unable to successfully login using our AD credentials using Spark IM and Pandium IM. After trying nearly 100 different variations of server configs, we decided to try a new client. I installed Miranda IM on my Windows XP machine and tried a few different setups. It turned out that the magic potion was to make sure that the "resource" field was set to "Home" and use SSL for encryption. This resource setting was the deal breaker for the other IM clients as many of them such as Spark and Pandium do not have this as a login option.
We ended up using Pidgin IM as the Windows client of choice as it did have the resource variable and it's interface was the best suited for our environment and users.
I hope this helps someone out there as we spent days looking all over the internet trying to figure this out.
Cheers,
Frenchy and Super Brent

Hi,
iChat Server is not something that I know a great deal about.
I tend to point people to the OS X Server Communities and to look out for posts by Tim Harris.
Thanks for taking the time to post this.
9:58 PM Friday; February 10, 2012
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"
 iMac 2.5Ghz 5i 2011 (Lion 10.7.3)
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb (Snow Leopard 10.6.8)
 Mac OS X (10.6.8),
"Limit the Logs to the Bits above Binary Images."  No, Seriously

Uncaught exception raised in Open Directory client-side plugin

I am having an issue whenever I try to access my Open Directory. It says Uncaught exception raised in Open Directory client-side plugin.
In updateConfigurationViewFromDescription: NSInvalidArgumentException *** - [NSplaceholderMutableString initWithString:]: nil argument.
I'm having a hard time finding a directory with the relative plugin. Could you point me the right way? Perhaps finding and deleting that little bugger would help? I'm running Lion Server 10.7.3 with the 10.7.3 Server Admin tools. The goal here is to set up Deploy Studio for our organization, which I had working for a little while until this little guy started rearing his ugly head.
Thanks much-

Dear cdolan92,
not really. It has been a while. I think I also deleted server.app and admin tools and reinstalled those.
Perhaps I even did a backup of open directory and turned off the master to local and back to master.
But I am not sure any more.
Sorry.
Best
H.

Open Directory conection for Client inconsistant

Similar Messages

Maybe you are looking for